CVE-2016-8673: CSRF
First published: Wed Nov 23 2016(Updated: )
A vulnerability has been identified in SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.0.53), SIMATIC CP 443-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.2.17), SIMATIC S7-300 PN/DP CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP CPU family (incl. SIPLUS variants) (All versions). The integrated web server at port 80/TCP or port 443/TCP of the affected devices could allow remote attackers to perform actions with the permissions of an authenticated user, provided the targeted user has an active session and is induced to trigger the malicious request.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Siemens SIMATIC S7-300 CPU | ||
| Siemens SIMATIC S7-300 CPU | ||
| Siemens Simatic CP 443-1 | ||
| Siemens Simatic CP443-1 | ||
| Siemens Simatic CP 343-1 | ||
| Siemens Simatic CP 343-1 Advanced | ||
| Siemens SIMATIC S7-400 CPU | ||
| Siemens SIMATIC S7-400 CPU |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2016-8673?
CVE-2016-8673 has a high severity rating due to the potential for unauthorized access to sensitive information in affected Siemens devices.
How do I fix CVE-2016-8673?
To remediate CVE-2016-8673, update the firmware of affected devices to the latest versions specified by Siemens.
Which Siemens devices are affected by CVE-2016-8673?
CVE-2016-8673 affects various Siemens devices, including SIMATIC CP 343-1 Advanced and SIMATIC S7-300 PN/DP CPU family among others.
What are the consequences of CVE-2016-8673 exploitation?
Exploitation of CVE-2016-8673 may lead to unauthorized control or manipulation of devices, resulting in operational disruptions.
Is there a delay in patching CVE-2016-8673 needed?
Timely patching is crucial for CVE-2016-8673 to minimize the risk of exploitation, as delaying may leave systems vulnerable.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/severity
- agent/references
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/siemens
- canonical/siemens simatic s7-300 cpu
- canonical/siemens simatic cp 443-1
- canonical/siemens simatic cp443-1
- canonical/siemens simatic cp 343-1
- canonical/siemens simatic cp 343-1 advanced
- canonical/siemens simatic s7-400 cpu